The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute external tools required for its workflow, including the LaTeX compilation suite (xelatex, bibtex) and the pandoc conversion utility. The execution is handled within the scripts/compile_latex_with_bibtex.py and scripts/convert_latex_to_word.py files. While shell=True is employed during LaTeX compilation to manage environment variables like TEXINPUTS, the implementation correctly uses shlex.quote to sanitize command-line arguments and prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill performs automated retrieval of academic paper metadata and abstracts from reputable and well-known services. Specifically, it interfaces with the OpenAlex, Semantic Scholar, and Crossref APIs via scripts such as scripts/openalex_search.py, scripts/semantic_scholar_search.py, and scripts/multi_source_abstract.py. These activities are documented as intended functionality for literature retrieval and do not involve the execution of downloaded remote code.
[DATA_EXPOSURE_AND_EXFILTRATION]: To prevent unauthorized file access or data leakage, the skill implements a path isolation security layer in scripts/path_scope.py. This module uses an environment variable SYSTEMATIC_LITERATURE_REVIEW_SCOPE_ROOT to restrict all file I/O operations to the designated project work directory, effectively mitigating directory traversal risks.
[CREDENTIALS_UNSAFE]: Analysis of the source code confirms that no hardcoded credentials or API keys are present. The scripts/semantic_scholar_search.py script appropriately retrieves required API keys from environment variables.

research-literature-review